example: use ServiceAccount for cluster authentication

bpmct · bpmct · commit 98b7d05ad074 · 2022-04-20T21:28:00.000Z
diff --git a/examples/kubernetes-multi-service/README.md b/examples/kubernetes-multi-service/README.md
@@ -3,3 +3,75 @@ name: Develop multiple services in Kubernetes
 description: Get started with Kubernetes development.
 tags: [cloud, kubernetes]
 ---
+
+# Authentication
+
+This template has several ways to authenticate to a Kubernetes cluster.
+
+## kubeconfig (Coder host)
+
+If the Coder host has a local `~/.kube/config`, this can be used to authenticate with Coder. Make sure this is on the same user running the `coder` service.
+
+## ServiceAccount
+
+Create a ServiceAccount and role on your cluster to authenticate your template with Coder.
+
+1. Run the following command on a device with Kubernetes context:
+
+    ```sh
+    CODER_NAMESPACE=default
+    kubectl apply -n $CODER_NAMESPACE -f - <<EOF
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+    name: coder
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+    name: coder
+    rules:
+    - apiGroups: ["", "apps", "networking.k8s.io"] # "" indicates the core API group
+        resources: ["persistentvolumeclaims", "pods", "deployments", "services", "secrets", "pods/exec","pods/log", "events", "networkpolicies", "serviceaccounts"]
+        verbs: ["create", "get", "list", "watch", "update", "patch", "delete", "deletecollection"]
+    - apiGroups: ["metrics.k8s.io", "storage.k8s.io"]
+        resources: ["pods", "storageclasses"]
+        verbs: ["get", "list", "watch"]
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+    name: coder
+    subjects:
+    - kind: ServiceAccount
+        name: coder
+    roleRef:
+    kind: Role
+    name: coder
+    apiGroup: rbac.authorization.k8s.io
+    EOF
+    ```
+
+   1. Use the following commands to fetch the values:
+
+        **Cluster IP:**
+
+        ```sh
+        kubectl cluster-info | grep "control plane"
+        ```
+
+        **CA certificate**
+
+        ```sh
+        kubectl get secrets -n $CODER_NAMESPACE -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='coder')].data['ca\.crt']}{'\n'}"
+        ```
+
+        **Token**
+
+        ```sh
+        kubectl get secrets -n $CODER_NAMESPACE -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='coder')].data['token']}{'\n'}"
+        ```
+
+        **Namespace**
+
+        This should be the same as `$CODER_NAMESPACE`, set in step 1.
diff --git a/examples/kubernetes-multi-service/main.tf b/examples/kubernetes-multi-service/main.tf
@@ -11,8 +11,62 @@ terraform {
   }
 }
 
+variable "step1_use_kubeconfig" {
+  type        = bool
+  sensitive   = true
+  description = "Use local ~/.kube/config? (true/false)"
+}
+
+variable "step2_cluster_host" {
+  type        = string
+  sensitive   = true
+  description = <<-EOF
+  Hint: You can use:
+  $ kubectl cluster-info | grep "control plane"
+
+
+  Leave blank if using ~/.kube/config (from step 1)
+  EOF
+}
+
+variable "step3_certificate" {
+  type        = string
+  sensitive   = true
+  description = <<-EOF
+  Use docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount to create a ServiceAccount for Coder and grab values.
+
+  Enter CA certificate
+
+  Leave blank if using ~/.kube/config (from step 1)
+  EOF
+}
+
+variable "step4_token" {
+  type        = string
+  sensitive   = true
+  description = <<-EOF
+  Enter token (refer to docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount)
+
+  Leave blank if using ~/.kube/config (from step 1)
+  EOF
+}
+
+variable "step5_coder_namespace" {
+  type        = string
+  sensitive   = true
+  description = <<-EOF
+  Enter namespace (refer to docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount)
+
+  Leave blank if using ~/.kube/config (from step 1)
+  EOF
+}
+
 provider "kubernetes" {
-  config_path = "~/.kube/config"
+  # Authenticate via ~/.kube/config or a Coder-specific ServiceAccount, depending on admin preferences
+  config_path            = var.step1_use_kubeconfig == true ? "~/.kube/config" : null
+  host                   = var.step1_use_kubeconfig == false ? var.step2_cluster_host : null
+  cluster_ca_certificate = var.step1_use_kubeconfig == false ? base64decode(var.step3_certificate) : null
+  token                  = var.step1_use_kubeconfig == false ? base64decode(var.step4_token) : null
 }
 
 data "coder_workspace" "me" {}
